CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: b...

baserunner

Baserunner 用于探索和利用 Firebase 数据存储的工具。请参阅我们博客上的这篇文章，了解 Firebase 的工作原理以及我们为何开发此工具。 设置 1. git clone https://github.com/iosiro/baserunner.git 2. cd baserunner 3. npm install 4. npm run build 5. npm start 6. 在浏览器中打开 http://localhost:47710。 使用方法 Baserunner 界面如下所示： 首先，使用配置文本框从您要测试的应用中加载 Firebase 配置 JSON...

AZL-102582 CVE-2026-90185 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

EUVD-2026-81778

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

CVE-2026-74926 MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nouveau: fixed a race condition related to ptr storage operations. When running many VK CTS tests in parallel against nouveau, every few hours, you might encounter a crash like this. BUG: Kernel NULL pointer dereferencing, addres...

CVE-2026-85600: Improper Neutralization of Input During Web Page Generation

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...

Arbitrary Query Execution

Spring AI Vector Stores are vulnerable to Arbitrary Query Execution. The vulnerability is due to insufficient sanitization of special characters in vector store queries, allowing attackers to inject and execute arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB...

CVE-2026-17596

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

EUVD-2026-54518

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

CVE-2026-16041

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...

CVE-2026-17596: Improper Neutralization of Input During Web Page Generation

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

CVE-2024-6832

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

CVE-2024-6832

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

CVE-2025-11850

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2025-11850

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2025-11850 Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2025-11850 Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2025-11850

CVE-2025-11850 affects the WSO2 Identity Server: when secondary user stores are configured, the implicit-association resolver can initialize from a secondary store and bypass the primary store during search/uniqueness checks, allowing a subject to be linked to an unintended local account if the s...

CVE-2024-6832 Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...